Letting users trust their own MCP clients, without opening a phishing hole

Stream Vessel has introduced a fix for its MCP server that lets users connect their own MCP clients without requiring the operator to manually allowlist each redirect URI, closing a phishing gap that has plagued OAuth-enabled agent integrations. The problem is widespread: a May 2026 study of 119 OAuth-enabled MCP servers found that 114, or 95.8%, accepted arbitrary redirect URIs from anonymous requesters, exposing users to attacks in which a fake client named "Claude" registers an attacker-controlled callback address and steals the authorization code after a user clicks Approve on a genuine consent screen. Existing allowlists—covering clients such as Claude, ChatGPT, Cursor and VS Code—keep servers safe but shut out custom agents, a friction reported by Cursor users hitting Atlassian's redirect URI restrictions and by GitHub's MCP server, which requires a registered OAuth app per host. PKCE does not solve the issue because the attacker initiates the flow, and self-declared client names prove nothing. The change matters because it lets operators keep open registration without trusting every redirect address, and the next thing to watch is whether other MCP server operators adopt similar validation before the practice spreads.